x/net/internal/socket: (*iovec).set crashes on empty slice

[jesselucas]

What version of Go are you using (go version)?

go version go1.9 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOOS="darwin"

What did you do?

Used a nil slice as the payload for ipv6.NewPacketConn WriteTo method:

n, err := p.WriteTo([]byte{}, nil, c.LocalAddr()) caused a panic.

https://play.golang.org/p/K9b6ts4oAh

What did you expect to see?

I expected an error or nothing to happen.

What did you see instead?

panic: runtime error: index out of range

goroutine 1 [running]:
golang.org/x/net/internal/socket.(*iovec).set(...)
	/Users/jesse/gocode/src/golang.org/x/net/internal/socket/iovec_64bit.go:13
golang.org/x/net/internal/socket.(*msghdr).pack(0xc42007a7e0, 0xc420076410, 0x1, 0x1, 0xc420090200, 0x1, 0x1, 0x0, 0x0, 0x0, ...)
	/Users/jesse/gocode/src/golang.org/x/net/internal/socket/msghdr_bsd.go:13 +0x1c3
golang.org/x/net/internal/socket.(*Conn).sendMsg(0xc4200901a0, 0xc42004dd58, 0x0, 0x11dec01, 0xc420090200)
	/Users/jesse/gocode/src/golang.org/x/net/internal/socket/rawconn_msg.go:58 +0x105
golang.org/x/net/internal/socket.(*Conn).SendMsg(0xc4200901a0, 0xc42004dd58, 0x0, 0x0, 0x22)
	/Users/jesse/gocode/src/golang.org/x/net/internal/socket/socket.go:260 +0x3f
golang.org/x/net/ipv6.(*payloadHandler).writeTo(0xc42008c1f0, 0x1202900, 0x0, 0x0, 0x0, 0x11d0f00, 0xc42007a6f0, 0x22, 0x0, 0x0)
	/Users/jesse/gocode/src/golang.org/x/net/ipv6/payload_cmsg_go1_9.go:52 +0x16c
golang.org/x/net/ipv6.(*payloadHandler).WriteTo(0xc42008c1f0, 0x1202900, 0x0, 0x0, 0x0, 0x11d0f00, 0xc42007a6f0, 0x0, 0x0, 0x0)
	/Users/jesse/gocode/src/golang.org/x/net/ipv6/payload_cmsg.go:34 +0x97
main.main()
	/Users/jesse/gocode/src/github.com/jesselucas/mctest/main.go:45 +0x3c8
exit status 2

[ianlancetaylor]

The iovec.set methods in x/net/internal/socket are to blame. They assume they can take the address of b[0]:

func (v *iovec) set(b []byte) {
	v.Base = (*byte)(unsafe.Pointer(&b[0]))
	v.Len = uint64(len(b))
}

[gopherbot]

Change https://golang.org/cl/67750 mentions this issue: internal/socket: don't crash with empty Message.Buffers